I recommend switching from Deployment Monitor to Splunk on Splunk (S.o.S.). There are no current plans for a new DepMon release. S.o.S. is actively and lovingly maintained/updated by our Support Team. The reporting and monitoring capability in S.o.S. is really top-notch. ... View more

Can you confirm that you can connect to the SQL Server system from the box where you are running dbx? It sounds to me like you're not getting a response from the remote system. The dbx/databases endpoint , as far as I understand it, is waiting on the javabridge to return a connection from the remote system. ... View more

What RDBMS are you trying to connect to? ... View more

have you tried using a subsearch? ... View more

What version of DBX and Splunk are you using? As far as I know, role inheritance works just fine, but just to factor out any inheritance-related issues , can you test with dbx_user assigned directly to the user? ... View more

A heavy forwarder is a full version of Splunk. The thing that makes it a forwarder is turning on forwarding . Have you followed the steps here to turn on forwarding? http://docs.splunk.com/Documentation/Splunk/6.1.1/Forwarding/Deployaheavyforwarder ... View more

Hi maradibs, I'm sorry that you're still having trouble. Data for the Deployment monitor goes to and only goes to the _internal index. If you see the forwarder in the dashboard, there are definitely events for it in the _internal index As mentioned by somesoni, the _internal index is where you will see any errors. Make sure your time range covers an appropriate time range as it is possible that your forwarder was reporting previously but is not longer. If you still don't see any events. Try looking directly at splunk/var/log/splunk/splunkd.log on your forwarder ... View more

Here is the first part of of the all_forwarders search macro definition [forwarder_metrics] definition = index="_internal" source="*metrics.lo*" group=tcpin_connections If you would like to search the same events being used by the deployment monitor, make sure and specify index=_internal in your search. ... View more

lol. nvd3 is d3. These examples show you how to feed Splunk data into the D3 toolkit and visualize it. If you prefer raw js / html, then you can visit examples here: http://dev.splunk.com/view/SP-CAAAEN6 Finally, if you prefer to develop using the older Module system and Advanced XML , check out the HadoopOps app on apps.splunk.com. The HadoopOpsGauge module uses d3. ... View more

Download and install the Web Framework Toolkit App. It has the examples you're looking for. ... View more

warnerd, you can definitely run the *Nix app on Splunk for Windows. As jcoates mentions, install your forwarders and TAs (also referred to as Add-ons) on the remote system. Install the full app on your Splunk Search Head (your Windows 2008R2 machine). ... View more

sure, can you give an example ? ... View more

oh , i'm not sure if this is just a typo in your question, but from what I can see the logfiles directory is CamelCase : System32\LogFiles\ , not System32\logfiles ... View more

are any errors showing up in your _internal index? ... View more

the reason this is inefficient is that you are asking the system to do a full scan of the index and aggregate the count. Your poor indexers have to process every single event . |metadata is what you want. ... View more

Two questions: Can you do a more general search in _index to see if there is anything specific initiating the request to delete the index? If you find no root cause in 1) , what happens if you actively delete the index, then restart, then recreate the index with the same name. Does the behavior persist? ... View more

It looks to me like the code is passing the stanza name to s3 as-is. That would mean you can use any valid s3 key. To test if you're using a valid s3 key, I really like the aws cli utility . It is available as a pip package. You can install it with pip install awscli. Then, from the command line you can run: aws s3 ls s3:// / ... View more

This search does not support your argument. Timechart is quantizing into buckets, representing a large enough set such that last() will be greater than the event at the end of the quantized bin. Events are processed in time reverse order, but because there may be tsidx fragments or multiple indexers there is no strict localized ( small scale) order without an order by function. this is exactly like the law of large numbers. Check out these links: http://wiki.splunk.com/Deploy:UnderstandingBuckets http://docs.splunk.com/Documentation/Splunk/6.0.1/Indexer/HowSplunkstoresindexes ... View more

if you think there is a bug, please open a case with support. Based on my understanding of the engine and your sample search, the system is behaving exactly as expected. Good luck! ... View more

This is an interesting observation! There are a few things that can explain this for example: Report Acceleration. In this case we could already have the value, say for 2 days ago calculated. There is no reason to recalculate that value, whereas the value for today , needs to be fully scanned to calculate the value. Also, the UI comes into play. Javascript is single threaded and by the time an event is acted upon, it could have several buckets of data to draw. It would be interesting to look at the results from the preview endpoint in Chrome or FF Net console. ... View more

There is not a guaranteed order here. Imagine you have 3 indexers feeding your search. Whoever is fastest to get the first result back to the SH wins the race. Data is processed from newest -> oldest. These two things are not mutually exclusive. ... View more

You can find this information directly in the config files . Here is the stanza from server.conf that lists the update servers [applicationsManagement] allowInternetAccess = true url = https://splunkbase.splunk.com/api/apps loginUrl = https://splunkbase.splunk.com/api/account:login/ detailsUrl = https://splunkbase.splunk.com/apps/id updateHost = https://splunkbase.splunk.com updatePath = /api/apps:resolve/checkforupgrade updateTimeout = 24h ... View more

What you want is the modulo operator. It is essentially the remainder after a division operation. As the dividend increases, the remainder increases, until a number is reached that divides perfectly and thus the remainder resets to zero over and over again. Exactly what you are looking for. Here is a sample query: index=_internal | stats count as cat_val by date_hour | accum cat_val as subtotal | eval i = subtotal % 6 Notice that i cycles between 0 and 5 and then continues to cycle as you want. ... View more